3 ms·
> Al-Bassam writes that the tool works by sending a packet to the target machine that makes it dump some of its memory. Included in that dump is the VPN’s authe
by acqq 10y ago
> Al-Bassam writes that the tool works by sending a packet to the target machine that makes it dump some of its memory. Included in that dump is the VPN’s authentication password, which is used to log into the device.
> Both Al-Bassam and Maksym Zaitsev, another researcher who has been looking into BENIGNCERTAIN, believe that the attack is likely capable of extracting private encryption keys from VPNs as well, which is another, more robust way of authenticating access.
Seems similar to the famous "Heartbleed" OpenSSL bug, possibly even easier to achieve.
http://heartbleed.com/ http://heartbleed.com/
- bostik 10y agoActually, this tool brings up the question: did NSA discover and exploit Heartbleed years ago? That is not a conspiracy theory, btw. A few weeks back, H.D. Moore of Rapid7/Metasploit fame was on the Risky Business podcast. The topic of the week was bug bounty programs, and in particular the larger programs that aggregate individual vendors under a common umbrella - and notably a common set of guidelines. Moore mentioned that a recurring theme is that when researchers discover a new trick, they will the proceed to apply that trick to every possible vendor on the bounty program, netting 2-3k from each one they pop. In the same vein, I would find it odd if this extraction technique was not applied to every possible encryption target the NSA could think of.
- larrik 10y agoI would imagine that the NSA did discover and exploit Heartbleed years ago, yes. I've generally assumed that sort of thing was very likely, at least.
- ashitlerferad 10y agohttp://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-used-heartbleed-bug-exposing-consumers.html http://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-us...